[BUG] Vercel MCP OAuth token not persisted — empty accessToken after every auth

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

After completing the Vercel MCP OAuth flow (plugin:vercel-plugin:vercel / https://mcp.vercel.com), auth says "successful" but the accessToken is saved as an empty string in ~/.claude/.credentials.json. On every VS Code / Claude restart, the MCP error returns and re-auth is required. This has happened 3+ times in the same day.

What Should Happen?

After completing OAuth, the access token should be persisted to ~/.claude/.credentials.json so auth survives session restarts.

Error Messages/Logs

Contents of ~/.claude/.credentials.json after auth:
  "mcpOAuth": {
    "plugin:vercel-plugin:vercel|511b08192b045b3d": {
      "serverName": "plugin:vercel-plugin:vercel",
      "serverUrl": "https://mcp.vercel.com",
      "accessToken": "",   <-- always empty after auth
      "clientId": "cl_WbdtcToDrMR4ZHvXLGAmbfoYCsQjMeS8",
      "redirectUri": "http://localhost:40590/callback"
    }
  }

  /doctor output: ⚠ 1 setup issue: MCP

Steps to Reproduce

1. Install the Vercel plugin (vercel-plugin@vercel-vercel-plugin)
2. Start Claude Code — /doctor shows MCP auth warning
3. Run mcp__plugin_vercel-plugin_vercel__authenticate, open the auth URL
4. Complete OAuth in browser, paste callback URL to complete_authentication
5. Auth reports "successful", MCP tools work for the session
6. Restart VS Code / Claude Code
7. /doctor shows MCP error again — accessToken in .credentials.json is ""

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.165 (Claude Code)

Platform

Other

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

The mcp-needs-auth-cache.json also retains the entry for plugin:vercel-plugin:vercel after auth, suggesting the auth completion isn't clearing the "needs auth" state on disk either.